Hi All,
I have created Alerts on the basis of Error keyword . Below is one of my alert
index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR"|rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")| cluster showcount=t t=0.4|table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns |dedup Error_Message| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
On the basis of above query I am getting one of the Error message as shown below:
message = ERROR: ld.so: object 'libnss_wrapper.so' from LD_PRELOAD cannot be preloaded: ignored.
I want Error message with LD_PRELOAD should not come in Alerts.
Can someone guide me what should I change in my alerts
Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".
index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".
index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count